[转载]CoolCafe Chat脚本注入漏洞(SQL injection)及测试方法

信息来源：exploitlabs.com
文章作者：Donnie Werner

OVERVIEW
========
Cool Cafe features: multilingual support, multiple rooms,
database driven membership system, private discussion,
ignore users, admin broadcast to all rooms, online management,
text formatting. Source code available with online support to
help you install it

DETAILS
=======
1. SQL Injection

Cool Cafe Chat does not filter SQL resulting in
full access to the manager function menu.

1a. Password Disclosure
by selecting a chat room and selecting "manager" you may retrieve
the real password of the administrator and email address
( or that of any user ).

POC
===
1.
------
entering SQL Injection type statement in the password field
causes the statement to be true.

http://[host]/coolcafe/login.asp

user: admin
password: 'or'

1a.
-------
http://[host]/Coolcafe/modifyUser.asp?nickname=admin
( must refer from [host] )

SOLUTION:
=========
vendor contact: no
note: vendor URL appears to be for a real(?) coffeeshop?